Add e2e coverage for --network host outbound connectivity

Context

Follow-up from the fix for #5775, which drops network isolation for
non-bridge network modes (host/none/custom) instead of building orphaned
DNS/egress sidecars.

The fix is covered by unit tests: the flag→builder explicitness wiring
(cmd/thv/app/run_flags_test.go), and a docker-layer mock test asserting no
DNS/egress/ingress sidecars and no HTTP_PROXY injection for host/none
(pkg/container/docker/client_deploy_test.go). Bridge-mode isolation already
has e2e coverage in test/e2e/network_isolation_test.go.

Gap

There is no end-to-end test that runs a real --network host MCP server and
confirms (a) outbound connectivity actually works, and (b) no orphaned
sidecars are created.

Why this is deferred

Host networking is platform-dependent — it is not supported on VM-based Docker
(Docker Desktop / OrbStack), as noted in pkg/container/docker/client.go. An
e2e test needs a Linux Docker Engine runner to be meaningful.

What to do

Add an e2e case (gated to a Linux Docker Engine runner) that starts an HTTP
MCP server with --network host, asserts the workload reports running,
performs a real outbound call successfully, and verifies no -dns/-egress
sidecar containers were created for it.

Start with test/e2e/network_isolation_test.go and the host-networking limitation documented in pkg/container/docker/client.go; run the existing e2e tests on a Linux Docker Engine runner. Add coverage for an HTTP MCP server using --network host, confirming it reaches an outbound endpoint, reports running, and creates no -dns or -egress sidecars.